Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ignore unknown sources rules macros #1920

Merged
merged 3 commits into from
Mar 18, 2022
Merged

Ignore unknown sources rules macros #1920

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fe051bb
Check for unknown sources earlier (to handle exceptions)
mstemm Mar 2, 2022
714de99
Skip macros with unknown sources
mstemm Mar 2, 2022
d1f695b
New tests for rule + exception, macro with unknown source
mstemm Mar 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions test/falco_tests_plugins.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,4 +103,20 @@ trace_files: !mux
- Cloudtrail Create Instance
stderr_contains: "Rule Cloudtrail Create Instance: warning .unknown-source.: unknown source aws_cloudtrail, skipping"

no_plugins_unknown_source_macro:
detect: False
rules_file:
- rules/plugins/cloudtrail_macro.yaml
trace_file: trace_files/empty.scap
stderr_contains: "Macro Some Cloudtrail Macro: warning .unknown-source.: unknown source aws_cloudtrail, skipping"

no_plugins_unknown_source_rule_exception:
detect: False
rules_file:
- rules/plugins/cloudtrail_create_instances_exceptions.yaml
trace_file: trace_files/empty.scap
rules_warning:
- Cloudtrail Create Instance
stderr_contains: "Rule Cloudtrail Create Instance: warning .unknown-source.: unknown source aws_cloudtrail, skipping"


9 changes: 9 additions & 0 deletions test/rules/plugins/cloudtrail_create_instances_exceptions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
- rule: Cloudtrail Create Instance
desc: Detect Creating an EC2 Instance
condition: evt.num > 0 and ct.name="StartInstances"
output: EC2 Instance Created (evtnum=%evt.num info=%evt.plugininfo id=%ct.id user name=%json.value[/userIdentity/userName])
exceptions:
- name: user_secreid
fields: [aws.user, aws.region]
priority: INFO
source: aws_cloudtrail
4 changes: 4 additions & 0 deletions test/rules/plugins/cloudtrail_macro.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
- macro: Some Cloudtrail Macro
condition: aws.user=bob
source: aws_cloudtrail

26 changes: 18 additions & 8 deletions userspace/engine/lua/rule_loader.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -460,6 +460,14 @@ function load_rules_doc(rules_mgr, doc, load_state)
v['source'] = "syscall"
end

valid = falco_rules.is_source_valid(rules_mgr, v['source'])

if valid == false then
msg = "Macro "..v['macro']..": warning (unknown-source): unknown source "..v['source']..", skipping"
warnings[#warnings + 1] = msg
goto next_object
end

if state.macros_by_name[v['macro']] == nil then
state.ordered_macro_names[#state.ordered_macro_names+1] = v['macro']
end
Expand Down Expand Up @@ -542,6 +550,14 @@ function load_rules_doc(rules_mgr, doc, load_state)
v['source'] = "syscall"
end

valid = falco_rules.is_source_valid(rules_mgr, v['source'])

if valid == false then
msg = "Rule "..v['rule']..": warning (unknown-source): unknown source "..v['source']..", skipping"
warnings[#warnings + 1] = msg
goto next_object
end

-- Add an empty exceptions property to the rule if not defined
if v['exceptions'] == nil then
v['exceptions'] = {}
Expand Down Expand Up @@ -735,6 +751,8 @@ function load_rules_doc(rules_mgr, doc, load_state)
arr = build_error_with_context(context, "Unknown top level object: "..table.tostring(v))
warnings[#warnings + 1] = arr[1]
end

::next_object::
end

return true, {}, warnings
Expand Down Expand Up @@ -1008,14 +1026,6 @@ function load_rules(rules_content,

if (filter_ast.type == "Rule") then

valid = falco_rules.is_source_valid(rules_mgr, v['source'])

if valid == false then
msg = "Rule "..v['rule']..": warning (unknown-source): unknown source "..v['source']..", skipping"
warnings[#warnings + 1] = msg
goto next_rule
end

state.n_rules = state.n_rules + 1

state.rules_by_idx[state.n_rules] = v
Expand Down